ansible-core 2.17.0 vulnerabilities

Known vulnerabilities in the ansible-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
L Improper Input Validation ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Improper Input Validation through the use of the `hostvars` object. Attackers can bypass unsafe content protections and execute templated content, leading to arbitrary code execution. This is only exploitable if attackers can modify the content returned to a play that utilizes `hostvars` to reference unsafe content How to fix Improper Input Validation? Upgrade `ansible-core` to version 2.16.9, 2.17.2 or higher.	[,2.16.9)[2.17.0b1,2.17.2)
M Incorrect Authorization ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Incorrect Authorization through the `user` module. An attacker can modify or replace file contents and take ownership of files on any system path by exploiting directory traversal permissions. Note: This is only exploitable if someone with root privileges uses the `user` module with the `generate_ssh_key` option (disabled by default) and targets an unprivileged user. The unprivileged user needs to have traversal permissions on the directory containing the exploited target file. How to fix Incorrect Authorization? Upgrade `ansible-core` to version 2.14.18rc1, 2.15.13rc1, 2.16.13rc1, 2.17.6rc1, 2.18.0rc2 or higher.	[,2.14.18rc1)[2.15.0b1,2.15.13rc1)[2.16.0b1,2.16.13rc1)[2.17.0b1,2.17.6rc1)[2.18.0b1,2.18.0rc2)

Vulnerability

Vulnerable Version

Improper Input Validation

ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy.

Affected versions of this package are vulnerable to Improper Input Validation through the use of the hostvars object. Attackers can bypass unsafe content protections and execute templated content, leading to arbitrary code execution. This is only exploitable if attackers can modify the content returned to a play that utilizes hostvars to reference unsafe content

How to fix Improper Input Validation?

Upgrade ansible-core to version 2.16.9, 2.17.2 or higher.

[,2.16.9)[2.17.0b1,2.17.2)

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization through the user module. An attacker can modify or replace file contents and take ownership of files on any system path by exploiting directory traversal permissions.

Note:

This is only exploitable if someone with root privileges uses the user module with the generate_ssh_key option (disabled by default) and targets an unprivileged user. The unprivileged user needs to have traversal permissions on the directory containing the exploited target file.

How to fix Incorrect Authorization?

Upgrade ansible-core to version 2.14.18rc1, 2.15.13rc1, 2.16.13rc1, 2.17.6rc1, 2.18.0rc2 or higher.

[,2.14.18rc1)[2.15.0b1,2.15.13rc1)[2.16.0b1,2.16.13rc1)[2.17.0b1,2.17.6rc1)[2.18.0b1,2.18.0rc2)

ansible-core@2.17.0 vulnerabilities

Radically simple IT automation

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?